Are SQL injection attacks possible in JPA?

Question

I\'m building a Java Web Application using Java EE 6 and JSF-2.0, using the persistence API for all database operations.

The back-end is MySQL, but I have used the

Answer 1

It's only possible if you're inlining user-controlled variables in a SQL/JPQL string like so:

String sql = "SELECT u FROM User u WHERE id=" + id;

If you aren't doing that and are using parameterized/named queries only, then you're safe.